phpseclib: X.509 Examples

Action:

Method:

Method:

Method:

Method:

<?php
include('File/X509.php');

$x509 = new File_X509();
$cert = $x509->loadX509('...'); // see google.crt

print_r($cert);
print_r($x509->getDNProp('CN'));
print_r($x509->getDN());
print_r($x509->getIssuerDNProp('CN'));
echo $x509->getPublicKey();
echo $x509->getDN(true);
echo $x509->getIssuerDN(true);
print_r($x509->getIssuerDN());
include('File/X509.php');

$x509 = new File_X509();
$x509->loadCA('...'); // see signer.crt
$cert = $x509->loadX509('...'); // see google.crt// see selfsigned.crt
echo $x509->validateSignature() ? 'valid' : 'invalid';
echo $x509->validateSignature(false) ?
    'valid' :
    'invalid';
// try it with "http://www.bing.com/search?q=phpseclib" too
echo $x509->validateURL('https://www.google.com/#q=phpseclib') ?
    'valid' :
    'invalid';
echo $x509->validateDate() ? 'valid' : 'invalid';
echo $x509->validateDate(strtotime('January 1, 2001')) ?
    'valid' :
    'invalid';
include('File/X509.php');
include('Crypt/RSA.php');

$privKey = new Crypt_RSA();
extract($privKey->createKey());
$privKey->loadKey($privatekey);

$x509 = new File_X509();
$x509->setPrivateKey($privKey);
$x509->setDNProp('id-at-organizationName', 'phpseclib demo cert');

$csr = $x509->signCSR();

echo $x509->saveCSR($csr);
include('File/X509.php');

$x509 = new File_X509();
$csr = $x509->loadCSR('...'); // see csr.csr

print_r($csr);
//echo $x509->validateSignature() ? 'valid' : 'invalid';
print_r($x509->getDNProp('O'));
print_r($x509->getDN());
echo $x509->getDN(true);
echo $x509->getPublicKey();
include('File/X509.php');

$x509 = new File_X509();
$spkac = $x509->loadSPKAC('...'); // see spkac.spkac

print_r($spkac);
//echo $x509->validateSignature() ? 'valid' : 'invalid';
?>

Output:

(see phpseclib: X.509: Decoder to try phpseclib's X.509 decoder with your own certificates)

$cert:
  • tbsCertificate
    • version
      • v3
    • serialNumber
      • 105827261859531100510423749949966875981
    • signature
      • algorithm
        • sha1WithRSAEncryption
      • parameters
        • null
    • issuer
      • rdnSequence
        • 0
          • 0
            • type
              • id-at-countryName
            • value
              • printableString
                • ZA
        • 1
          • 0
            • type
              • id-at-organizationName
            • value
              • printableString
                • Thawte Consulting (Pty) Ltd.
        • 2
          • 0
            • type
              • id-at-commonName
            • value
              • printableString
                • Thawte SGC CA
    • validity
      • notBefore
        • utcTime
          • Wed, 26 Oct 11 00:00:00 +0000
      • notAfter
        • utcTime
          • Mon, 30 Sep 13 23:59:59 +0000
    • subject
      • rdnSequence
        • 0
          • 0
            • type
              • id-at-countryName
            • value
              • printableString
                • US
        • 1
          • 0
            • type
              • id-at-stateOrProvinceName
            • value
              • printableString
                • California
        • 2
          • 0
            • type
              • id-at-localityName
            • value
              • teletexString
                • Mountain View
        • 3
          • 0
            • type
              • id-at-organizationName
            • value
              • teletexString
                • Google Inc
        • 4
          • 0
            • type
              • id-at-commonName
            • value
              • teletexString
                • www.google.com
    • subjectPublicKeyInfo
      • algorithm
        • algorithm
          • rsaEncryption
        • parameters
          • null
      • subjectPublicKey
        • -----BEGIN PUBLIC KEY-----
MIGJAoGBAN63JkOmmYXNOKcVCbnPD8nDVYyI7oyNKCckSypeoNgW+mEYS89tYIDTNUAycsCPEtjl
To+5svbZFV5ahjGjuoaqa8jZcYzMzScTHp1CXTj2p6zv+mLzGIHUJEZ/AXd8xiqJFJm7mDkdqBn7
OQBEfRuUangtaa3Aeiz60NogEpjTAgMBAAE=
-----END PUBLIC KEY-----
    • extensions
      • 0
        • extnId
          • id-ce-basicConstraints
        • critical
          • 1
        • extnValue
        • 1
          • extnId
            • id-ce-cRLDistributionPoints
          • critical
          • extnValue
            • 0
              • distributionPoint
                • fullName
                  • 0
                    • uniformResourceIdentifier
                      • http://crl.thawte.com/ThawteSGCCA.crl
        • 2
          • extnId
            • id-ce-extKeyUsage
          • critical
          • extnValue
            • 0
              • id-kp-serverAuth
            • 1
              • id-kp-clientAuth
            • 2
              • 2.16.840.1.113730.4.1
        • 3
          • extnId
            • id-pe-authorityInfoAccess
          • critical
          • extnValue
            • 0
              • accessMethod
                • id-ad-ocsp
              • accessLocation
                • uniformResourceIdentifier
                  • http://ocsp.thawte.com
            • 1
              • accessMethod
                • id-ad-caIssuers
              • accessLocation
                • uniformResourceIdentifier
                  • http://www.thawte.com/repository/Thawte_SGC_CA.crt
    • signatureAlgorithm
      • algorithm
        • sha1WithRSAEncryption
      • parameters
        • null
    • signature
      • ACGs1a7KNIlawqtS0rI0Zp16q+7mfNV+wlwou3QAyRAfQhP8aYoeJKACAOm6W8oZBLLTrwGyfl8U26bbUrma8xJ/fKKcO2+ZfepQDXYjEv/3ZnMpt5UKrdiLst4g6QpwZBEIyFrxfZ7saaWl1YLXJx6eVs3SdtV5K/clQxxp8Lj5
    $prop:
    • 0
      • www.google.com
    $dn:
    • rdnSequence
      • 0
        • 0
          • type
            • id-at-countryName
          • value
            • printableString
              • US
      • 1
        • 0
          • type
            • id-at-stateOrProvinceName
          • value
            • printableString
              • California
      • 2
        • 0
          • type
            • id-at-localityName
          • value
            • teletexString
              • Mountain View
      • 3
        • 0
          • type
            • id-at-organizationName
          • value
            • teletexString
              • Google Inc
      • 4
        • 0
          • type
            • id-at-commonName
          • value
            • teletexString
              • www.google.com
    C=US, ST=California, L=Mountain View, O=Google Inc, CN=www.google.com
    C=ZA, O=Thawte Consulting (Pty) Ltd., CN=Thawte SGC CA 
    -----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDetyZDppmFzTinFQm5zw/Jw1WM
iO6MjSgnJEsqXqDYFvphGEvPbWCA0zVAMnLAjxLY5U6PubL22RVeWoYxo7qGqmvI
2XGMzM0nEx6dQl049qes7/pi8xiB1CRGfwF3fMYqiRSZu5g5HagZ+zkARH0blGp4
LWmtwHos+tDaIBKY0wIDAQAB
-----END PUBLIC KEY-----
    $prop:
    • 0
      • Thawte SGC CA
    $dn:
    • rdnSequence
      • 0
        • 0
          • type
            • id-at-countryName
          • value
            • printableString
              • ZA
      • 1
        • 0
          • type
            • id-at-organizationName
          • value
            • printableString
              • Thawte Consulting (Pty) Ltd.
      • 2
        • 0
          • type
            • id-at-commonName
          • value
            • printableString
              • Thawte SGC CA

    Notes:

    An array is returned because each distinguished name property can (in theory) have multiple values

    Valid property names are enumerated upon at Distinguished Property Names.

    Output:

    -----BEGIN CERTIFICATE REQUEST-----
MIIBVjCBwgIAMB4xHDAaBgNVBAoME3BocHNlY2xpYiBkZW1vIGNlcnQwgZ0wCwYJKoZIhvcNAQEB
A4GNADCBiQKBgQDF+1/N2DwvdkhoHsLq8LnH99AEGVOGpooSpbPCewbuZeqr/Djb9ySPar2PLySo
Y+kB2QAbxUgpO/57IpWIabQ9jDFIznqLCcLzXKiKOWnMv4KMf55yJ6pwlqoTbUPgyQ67CRAfjcaD
W9VQ/TzdKahdxLFPBAEIEpEX23YpLhTLNQIDAQABMAsGCSqGSIb3DQEBBQOBgQALjJE4OygjvLm0
rzFyMPvAo7Ux6z5qTOi//HQzzmjNun7MV09GTfZgcYeWvuLosJXcn7CPALF5FqHWePs98WioTA7K
WsvdZzm+yJ5UcmzdJ/Jq9X8o1KTsMELN0SQwiNk502a1wbiXotF4OgCsjSdno96PCV9VSF4w69HM
1eXfvg==
-----END CERTIFICATE REQUEST-----

    Output:

    $csr:
    • certificationRequestInfo
      • version
        • v1
      • subject
        • rdnSequence
          • 0
            • 0
              • type
                • id-at-organizationName
              • value
                • utf8String
                  • phpseclib demo cert
      • subjectPKInfo
        • algorithm
          • algorithm
            • rsaEncryption
        • subjectPublicKey
          • -----BEGIN PUBLIC KEY-----
MIGJAoGBAKUAZcMKDkb0malJqS+aaAAy1rEQceebS7N2KvGX25EqPJx3rWz5zrpCD/zZcZ95/zBj
r7F0GvTS4rC0OlJsi8iV11VvBZ+qQkCKZ8oIzW6HILOro+O1BFw8DMJXyyj2fNDO4ZjKYWWeFG/y
AXtEuSje+2MWLxShinzDVymVsdf/AgMBAAE=
-----END PUBLIC KEY-----
    • signatureAlgorithm
      • algorithm
        • sha1WithRSAEncryption
    • signature
      • ACEVzXM3m2ub2cu+AHQ2yJqs73xsH/BPxW+S2YXpvzTODypG5pO8haK5wR8nNmWs2puiDrz0zcbrRrJ4ZiwbFMpRr7E9AaiSMTd291qjOpABqxLonJ6p0q2j1y633XlavuTAi63UmsFszc27BFhaX04XgYST/2+DDyK816fNBcio
    $prop:
    • 0
      • phpseclib demo cert
    $prop:
    • rdnSequence
      • 0
        • 0
          • type
            • id-at-organizationName
          • value
            • utf8String
              • phpseclib demo cert
    O=phpseclib demo cert 
    -----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQClAGXDCg5G9JmpSakvmmgAMtax
EHHnm0uzdirxl9uRKjycd61s+c66Qg/82XGfef8wY6+xdBr00uKwtDpSbIvIlddV
bwWfqkJAimfKCM1uhyCzq6PjtQRcPAzCV8so9nzQzuGYymFlnhRv8gF7RLko3vtj
Fi8UoYp8w1cplbHX/wIDAQAB
-----END PUBLIC KEY-----

    Output:

    $spkac:
    • publicKeyAndChallenge
      • spki
        • algorithm
          • algorithm
            • rsaEncryption
          • parameters
            • null
        • subjectPublicKey
          • -----BEGIN PUBLIC KEY----- MIGJAoGBAIzTQEESviJEW6LxBEAuRNn/ImNNtWx6bJ6R8hiUiyaqiWmCSFc2Re/Z E1KQzzJYZLv7jlgSjZVvdf3z/bP7yPhvbhx4HmDRnoH9FdzoSm8edfUZgxih+x+M /ZTeKzypha+7M++ZzvEP5A5vrAXmn0VdI4aNeae6WOM9p4vAAXcDAgMBAAE= -----END PUBLIC KEY-----
      • challenge
        • 123456789
    • signatureAlgorithm
      • algorithm
        • md5WithRSAEncryption
      • parameters
        • null
    • signature
      • AIfIg6pR1bSrC7FZISLMeZnvvg7xPOOiCPRAaarxs+h9rPzesrtJT8hDhI7MdOpWefoV2tD8JSAn+tQARecqb5556B9v0sIdUYLJSZ3YIt6e3sJJvNlTSvnPgQ0st4AhgOz7DcWTghRbFQUo8uTamYdk8NOw7w88STSmWp4pJi30